It would have to be something in their email address itself (special character they share that the other 98 don't)
Beyond that you would need to do a Wireshark trace to see what leaves the machine and what happens in comparison to the other 98 users.
There is no simple fix unless the machine is using network logins so that those 2 users's credentials would come into play. Because with that exception, every email uses the same from address, authentication data, email body, subject line and attachment name.